IP Address Validation Flaw in Fortinet FortiProxy and FortiOS
CVE-2024-26015

4.7MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortiproxy
Vendor
CVE Published:
9 July 2024

What is CVE-2024-26015?

A vulnerability in Fortinet's FortiProxy and FortiOS allows an unauthenticated attacker to exploit improper number parsing in the IP address validation feature. This flaw enables attackers to bypass configured IP blocklists by sending crafted requests, potentially compromising security protocols intended to protect sensitive systems and data. Affected versions must be updated to mitigate this risk.

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-446

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.